---
id: "CVE-2026-78192"
kind: "vulnerability"
aliases: ["CVE-2026-78192"]
title: "WebDyne Perl: default index page leaks application source code to anyone"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "perl", "self-hosted", "webdyne"]
not_affected_if: ["default-config-changed"]
published_at: "2026-10-31T15:16:54+00:00"
first_seen_at: "2026-10-31T15:36:19+00:00"
updated_at: "2026-10-31T15:36:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78192", "first_seen_at": "2026-10-31T15:36:19+00:00"}]
---

# WebDyne Perl: default index page leaks application source code to anyone

WebDyne's default index page includes a source viewer that returns files under the document root, including .psp, .pm and .pl files, when requested by name. An unauthenticated remote attacker can read the application's Perl code, including embedded credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the WebDyne version installed with the Perl module (`perl -MWebDyne -e 'print $WebDyne::VERSION'`), looking for a version from 2.022 up to but not including 3.022.
- Check whether the wrapper script (such as `webdyne.psgi`) serves the built-in index page, which is enabled by default.

## Fix

- WebDyne `3.022` or later (the affected range is 2.022 before 3.022).

## Timeline

- 2026-10-31T15:36:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-78192

## From the sources

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page.

WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root named in the source parameter of an HTMX request, including .psp, .pm and .pl files.

A remote attacker can read the application's Perl code, including the __PERL__ blocks of .psp pages and any credentials they hold.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_